Threats Tagged 'ghsa-c875-h985-hvrc'

Scriban versions prior to 7.0.0 have a vulnerability where the LoopLimit setting does not apply to expensive iterations performed inside built-in operations and operators. This allows an attacker to craft templates that cause excessive CPU or memory consumption, bypassing the intended loop iteration limits. For example, expressions like {{ 1..1000000 | array.size }} can force large CPU work despite a low LoopLimit. Similarly, string multiplication can cause large memory allocations. This uncontrolled resource consumption can lead to denial of service in applications that process untrusted templates using Scriban.